e11db17a5ada366378bf9d290e2a0d0227f1050799fc019f7be237d0bb003635

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:53

Target

51fb8a3e6820f3a5ec843a2f445d27cd.exe
Size

33KB
MD5

51fb8a3e6820f3a5ec843a2f445d27cd
SHA1

fb893aaa29d846ad6a0e9dcb2696bc199c6ad64f
SHA256

e11db17a5ada366378bf9d290e2a0d0227f1050799fc019f7be237d0bb003635
SHA512

5d054943f69c4e28323cf1b376867ccde0b53b12ebc19685f042141d5d70b2845a3f0a798f184f731128984365c59f8a74c8f8efc3293acafef95d6e05304078
SSDEEP

768:Z7e0D3XjRal6bOS90vyiMrTxRX0I666Sr2ZvMjBtL3MBJeZv:le0DnjRrJavyFnUIRr2vMYBJeJ

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3040	2580	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3040	2580	51fb8a3e6820f3a5ec843a2f445d27cd.exe	28
PID 2580 wrote to memory of 3040	2580	51fb8a3e6820f3a5ec843a2f445d27cd.exe	28
PID 2580 wrote to memory of 3040	2580	51fb8a3e6820f3a5ec843a2f445d27cd.exe	28
PID 2580 wrote to memory of 3040	2580	51fb8a3e6820f3a5ec843a2f445d27cd.exe	28

C:\Users\Admin\AppData\Local\Temp\51fb8a3e6820f3a5ec843a2f445d27cd.exe
"C:\Users\Admin\AppData\Local\Temp\51fb8a3e6820f3a5ec843a2f445d27cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 180
  2⤵
  - Program crash
  PID:3040

memory/2580-0-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download